The checksum of the source archive keeps changing

[afbjorklund]

The source code .tar.gz is using git attributes, which means that the contents changes when the short commit does.

This makes it fail packaging checks, because the checksum of the tarball doesn't match (for the same git commit)

diff -ur cri-o/vendor/k8s.io/client-go/pkg/version/base.go cri-o-1.20.2/vendor/k8s.io/client-go/pkg/version/base.go
--- cri-o/vendor/k8s.io/client-go/pkg/version/base.go	2020-05-07 17:59:37.153050743 +0200
+++ cri-o-1.20.2/vendor/k8s.io/client-go/pkg/version/base.go	2021-03-24 03:33:41.000000000 +0100
@@ -55,8 +55,8 @@
 	// NOTE: The $Format strings are replaced during 'git archive' thanks to the
 	// companion .gitattributes file containing 'export-subst' in this same
 	// directory.  See also https://git-scm.com/docs/gitattributes
-	gitVersion   string = "v0.0.0-master+$Format:%h$"
-	gitCommit    string = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD)
+	gitVersion   string = "v0.0.0-master+d5a999ad0a"
+	gitCommit    string = "d5a999ad0a35d895ded554e1e18c142075501a98" // sha1 from git, output of $(git rev-parse HEAD)
 	gitTreeState string = ""            // state of git tree, either "clean" or "dirty"
 
 	buildDate string = "1970-01-01T00:00:00Z" // build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')
diff -ur cri-o/vendor/k8s.io/component-base/version/base.go cri-o-1.20.2/vendor/k8s.io/component-base/version/base.go
--- cri-o/vendor/k8s.io/component-base/version/base.go	2020-05-07 17:59:37.165050759 +0200
+++ cri-o-1.20.2/vendor/k8s.io/component-base/version/base.go	2021-03-24 03:33:41.000000000 +0100
@@ -55,8 +55,8 @@
 	// NOTE: The $Format strings are replaced during 'git archive' thanks to the
 	// companion .gitattributes file containing 'export-subst' in this same
 	// directory.  See also https://git-scm.com/docs/gitattributes
-	gitVersion   = "v0.0.0-master+$Format:%h$"
-	gitCommit    = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD)
+	gitVersion   = "v0.0.0-master+d5a999ad0a"
+	gitCommit    = "d5a999ad0a35d895ded554e1e18c142075501a98" // sha1 from git, output of $(git rev-parse HEAD)
 	gitTreeState = ""            // state of git tree, either "clean" or "dirty"
 
 	buildDate = "1970-01-01T00:00:00Z" // build date in ISO8601 format, output of $(date -u +'%Y-%m-%dT%H:%M:%SZ')

The short format is the root cause, but the whole information is quite useless.

Since it doesn't state the kubernetes version (like intended), but the cri-o git...

// This is the fallback data used when version information from git is not
// provided via go ldflags. It provides an approximation of the Kubernetes
// version for ad-hoc builds (e.g. `go build`) that cannot get the version
// information from git.
//
// If you are looking at these fields in the git tree, they look
// strange. They are modified on the fly by the build process. The
// in-tree values are dummy values used for "git archive", which also
// works for GitHub tar downloads.

Would it be possible to remove these files ? (with export-subst )

vendor/k8s.io/component-base/version/.gitattributes
vendor/k8s.io/client-go/pkg/version/.gitattributes

Downstream bugs:

• change crio-bin checksum since it changed upstream kubernetes/minikube#10975 v1.20.0
  (https://github.com/cri-o/cri-o/archive/v1.20.0.tar.gz)

• change crio-bin checksum since it changed upstream kubernetes/minikube#11221 v1.20.2
  (https://github.com/cri-o/cri-o/archive/v1.20.2.tar.gz)

Similar problem:

• The source tarball for podman 2.2.1 now has different checksum containers/podman#9355

[afbjorklund]

Today the checksum is different again. As compared to yesterday, same URL.

diff -ur cri-o-1.20.2.orig/vendor/k8s.io/client-go/pkg/version/base.go cri-o-1.20.2/vendor/k8s.io/client-go/pkg/version/base.go
--- cri-o-1.20.2.orig/vendor/k8s.io/client-go/pkg/version/base.go	2021-03-24 03:33:41.000000000 +0100
+++ cri-o-1.20.2/vendor/k8s.io/client-go/pkg/version/base.go	2021-03-24 03:33:41.000000000 +0100
@@ -55,7 +55,7 @@
 	// NOTE: The $Format strings are replaced during 'git archive' thanks to the
 	// companion .gitattributes file containing 'export-subst' in this same
 	// directory.  See also https://git-scm.com/docs/gitattributes
-	gitVersion   string = "v0.0.0-master+d5a999ad0a"
+	gitVersion   string = "v0.0.0-master+d5a999ad0a3"
 	gitCommit    string = "d5a999ad0a35d895ded554e1e18c142075501a98" // sha1 from git, output of $(git rev-parse HEAD)
 	gitTreeState string = ""            // state of git tree, either "clean" or "dirty"
 
diff -ur cri-o-1.20.2.orig/vendor/k8s.io/component-base/version/base.go cri-o-1.20.2/vendor/k8s.io/component-base/version/base.go
--- cri-o-1.20.2.orig/vendor/k8s.io/component-base/version/base.go	2021-03-24 03:33:41.000000000 +0100
+++ cri-o-1.20.2/vendor/k8s.io/component-base/version/base.go	2021-03-24 03:33:41.000000000 +0100
@@ -55,7 +55,7 @@
 	// NOTE: The $Format strings are replaced during 'git archive' thanks to the
 	// companion .gitattributes file containing 'export-subst' in this same
 	// directory.  See also https://git-scm.com/docs/gitattributes
-	gitVersion   = "v0.0.0-master+d5a999ad0a"
+	gitVersion   = "v0.0.0-master+d5a999ad0a3"
 	gitCommit    = "d5a999ad0a35d895ded554e1e18c142075501a98" // sha1 from git, output of $(git rev-parse HEAD)
 	gitTreeState = ""            // state of git tree, either "clean" or "dirty"

So now it doesn't work anymore in for instance Fedora, which also checksums:

1c01d4a76cdcfe3ac24147eb1d5f6ebd782bd98fb0ac0c19b79bd5a6560b1481  v1.20.2.tar.gz
36d9f4cf4966342e2d4099e44d8156c55c6a10745c67ce4f856aa9f6dcc2d9ba  v1.20.2.tar.gz.orig

af900c9b682c8f1c4a5814902aee1f616a735ff1f4c9442a554055257a477cd3ea19708c2303cffdfe4d215eab7ef5d2253a81817cfe66925d2d09458f9aea93  v1.20.2.tar.gz
0d17867d02cc1491dc14151bd97233e9127ff21152f65794f8e95d95719d47528246c8d4a7648a7586eedbf7e86bad45bfe194db7df7a391338d3d5e15633fdc  v1.20.2.tar.gz.orig

https://src.fedoraproject.org/rpms/cri-o/blob/1.20/f/sources

[saschagrunert]

Fix is incoming in #4824